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Preface 


Preface 


The SniffMaster I™ Installation and Operations Manual is the basic guide to your 
SniffMaster I system. Other documents are also useful. You will find them listed in 
Chapter 1 and referred to throughout this document. 


The organization of this manual follows the sequence of steps that a new user 
would typically follow. It begins with some preliminary information that 
introduces you to the system. Next, it explains the basic procedures for setting up 
the system. Finally, it covers some guidelines and tips on running the system. 


Chapter 1 provides information on various topics that you may want to review 
before installing and operating your SniffMaster I system. The chapter covers 
several possible SniffMaster I system configurations, an explanation of SniffMaster 
I system operation, a discussion of the variety of uses for a SniffMaster I system, 
the hardware and software requirements, and a list of documentation you will 
need to install and to operate your system. 


Chapter 2 explains how to install and to configure your SniffMaster I system. The 
procedures include setting up Sniffer remote analyzers, terminal servers, and the 
central console. 


Chapter 3 covers basic operating procedures for your SniffMaster I system. Topics 
include starting remote analyzers, setting options from the from the central 
console, and using the Sniffer features that are unique to the SniffMaster I system. 
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Chapter Overview 


SniffMaster I is a complete system that enables you to monitor and to analyze 
problems within distributed local area networks (LANs) from a SniffMaster I 
central console. Information from multiple network segments observed by Sniffer 
network analyzers is relayed to the central console in real time. There you can see 
what is happening anywhere on your network through windows on the central 
console’s screen. Furthermore, you can alter all options on any of the SniffMaster I 
remote Sniffer analyzers whenever you want. The SniffMaster I system gives you a 
complete set of tools for monitoring and analyzing your network. 


The remote Sniffer analyzers on each network segment are the eyes and the 
intelligence of the system. Each remote analyzer operates as a station on the LAN 
and allows you to look into the LAN, to recognize the simplest to the most 
complex problems, and to locate their sources quickly. The SniffMaster I console 
serves as an information display mechanism. 


The Sniffer family of diagnostic tools helps maintain, trouble-shoot, fine-tune, and 
expand a network. The two primary features of each network analyzer are seven- 
layer protocol decoding and traffic monitoring that includes statistical displays, 
alarms, and report generation. 


SniffMaster | Installation and Operations Manual 


SniffMaster | Configurations 


Figure 1 shows you several possible configurations within a SniffMaster I system. 
Each remote analyzer sends information to the central console via an analyzer’s 
serial (RS-232) port and through a TCP/IP terminal server. 


Central Console 


Ethernet Network Segment 


~ Asynchronous 
Leh i Connection i we 
IP Kita Server Remote Analyzer 2 
rw Lok 


TE 


Router 
Ethernet Network Segment 


Asynchronous 


Connection Token Ring 


Remote Analyzer 3 Network 


TCP/IP 
Terminal 
Server 


is Connection 
Remote Analyzer 1 


Figure 1. Several possible ways of linking Sniffer analyzers, terminal servers, and a central 
console to make a SniffMaster I system. 


The terminal server associated with Remote Analyzer 1 connects directly to one 
Ethernet® segment and to another via an IP router. A MAC layer bridge could also 
be used. On the other hand, the terminal server associated with Remote Analyzer 2 
is directly connected with a cable to the same Ethernet segment as the central 
console. Remote Analyzer 3 shares a terminal server with Remote Analyzer 2 and is 


connected via a wide-area network that supports asynchronous communications at 
19.2 Kbps.! 


How SniffMaster | Works 


Figure 2 shows how a central console communicates with a remote analyzer. On 
the central console side, a SunView™ application is running, and on the remote 


1 For the optimal SniffMaster I performance, 19.2 Kbps is recommended. However, connections at other baud rates 
are also supported. 
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analyzer side, a SniffMaster I terminate-and-stay-resident (TSR) program is 
running. Both sides use the SNiffer Remote Protocol (SNRP) and TCP/IP to 


communicate. 
SunView 
. Application 
— Asynchronous 
: s Ethernet Connection 
Central esi Remote 
Console site Analyzer 
aoe screens, line printer output = = —______ ‘ screens, line printer output peptigsien 
SNRP p> SNAP p> SNRP 
keystrokes, keystrokes, 
TCP configuration events TCP configuration events Serial I/O 
g 
IP | IP 
Pere 
DLC DLC 


Figure 2. Central console and remote analyzer communication. 


SNRP handles such things as sizing Sniffer screens, setting message sizes, setting 
intervals, transmitting Sniffer screens, and keyboard input and output. 


The TSR program in the Sniffer analyzer receives input from the remote analyzer’s 
keyboard and the central console’s keyboard. The TSR program also captures 
output directed to either the remote analyzer’s screen or printer port. The captured 
data is compressed and sent out of the serial port to the terminal server that, in 
turn, sends the data to the central console. 


Using the SniffMaster | System 


The SniffMaster I system has a number of specific capabilities you will find useful. 
One is centralized management of distributed LANs. You can monitor and analyze 
multiple local and remote LAN segments from a central console (a Sun 
workstation). This lets you utilize scarce networking expertise more effectively and 
provides for quicker problem resolution with instant visibility to any LAN 
segment. 


Another capability is simultaneous multi-segment monitoring and analysis. Using 
multiple windows on the central console, you can gather statistics and analyze 
network traffic on several LAN segments at the same time. 


You can take advantage of the big windows available on the central console with 
color displays of large amounts of statistical and network information. 
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Several forms of security are available for the remote Sniffer™ analyzers. Each 
Sniffer analyzer controlled by the central console can be password-protected to 
prevent unauthorized use. From the central console, you can also lock and unlock 
keyboards and screens on remote analyzers to prevent unauthorized users from 
examining network traffic. 


With the SniffMaster I system, you can analyze network data on the central 
console. You can transfer user-selected network data directly to the central console 
for printing, display, or storage in files for analysis by additional network 
management tools. 


Finally, you can run the SniffMaster I system concurrently with additional 
SunNet™ Manager or other Sun applications. The combination of the SniffMaster I 
system and SunNet Manager provides you with a broad and powerful network 
management solution. 


Hardware and Software Requirements 


In order to set up a complete SniffMaster I system, you'll need get some things 
from Network General Corporation (NGC) and some from other vendors. 


* Sniffer analyzer requirements: 


Network General Sniffer Analyzer models 300, 500, or 700 


Sniffer software, Version 3.00 or later 
* Terminal server requirements: 


Speed: Up to 19.2 Kbps (preferred) 

Protocols: Support for TCP/IP and raw TCP connection via specified ports 
Serial interface cable 

Products tested: Call NGC for updated list. 


* Workstation requirements: 


Models: SPARCstation I 
or Sun 3/80 


Memory: 8 Mbytes or greater 

Operating system: SUN OS 4.03 

Windowing system: SUNView 1.75 or higher 
Networking: Ethernet, TCP/IP 

Display: Monochrome or color 


SniffMaster I workstation software: tar tape from NGC 
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Documentation 


In addition to the manual you're now reading, the following publications will also 
help you get the most from the SniffMaster I system: 


SunView 1 Beginner’s Guide 

Sniffer Network Analyzer Installation Guide 

Sniffer Network Analyzer Operations Manual 

Sniffer Advanced Ethernet Network Monitor Users Manual 
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Chapter Overview 


Chapter 2 explains how to install and to configure a SniffMaster I system. The 
procedures include setting up the three major parts of the system. First, you need 
to prepare the Sniffer network analyzers to communicate with the central console. 
Second, you must attach each analyzer to a terminal server via a serial interface 
cable and then configure the terminal server. Finally, you need to set up the central 
console. 


Setting up a Sniffer Remote Analyzer 


The following instructions assume that you’ve attached each remote Sniffer 
analyzer to its network segment following your Sniffer Network Analyzer Installation 
Guide. Now you want to set up each SniffMaster I remote analyzer to communicate 
with terminal servers and, in turn, with the central console. 


Configuring SniffMaster | remote analyzer software 


The first step is to configure each remote analyzer. Start with the Sniffer main 
selection menu. Figure 3 shows the main selection menu that you see after 
booting an analyzer. The highlight is on the item, SniffMaster I remote analyzer. 
Select the item by pressing Enter. 


tm 
The Sniffer Network Analyzer 


(C) Copyright 1986-1990, Network General Corporation 
Hain selection menu 


Ethernet Analyzer Internal plasma display 
Ethernet Monitor External CGA color monitor 
Token-Ring Analyzer External LCD projector 
External EGA/VGA adapter 
Teiesnitifer Return to DOS 
Configuration Utility System shutdown 


to Sniffflaster I selection menu. 


Use arrow keys to select, then press Enter. 


Figure 3. Sniffer main selection menu. 
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Next you see the SniffMaster I remote analyzer selection menu (see Figure 4). 
The menu lists three items. You will want to configure the remote analyzer first. 
With the highlight on configure remote analyzer, press Enter. 


niffkaster I Remote Analyzer Selection 


Configure Remote Analyzer 


Install Remote Analyzer 
Return to main menu 


Configure the SniffMaster I Remote 
Analyzer 
Use arrow keys to select, then press Ente 


Figure 4. SniffMaster I remote analyzer selection menu. 


You now see the remote analyzer configuration menu (Figure 5 below). 


; , mais 
Network x Color console 300 baud 


General | 1200 baud 
Password = ae) 2400 baud 
4800 baud 


Remote Analyzer > 9600 baud 
| 


Configuration EXIT € 19200 baud 
38400 baud 
Version 1.00 


(C) Copyright 
1990 


i? Save} 
changes 


Figure 5. Remote analyzer configuration menu. 


Figure 6 summarizes the four options available on the remote analyzer 
configuration menu. You now need to determine which options are best suited to 
the requirements of your SniffMaster I system. 
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[Menultem [Choice [Function 


Color console |On Tells the central console that the remote 
Off analyzer is using a color console. 


Password 31 character limit | Specifies a password that must be entered 

at the central console. The default is 
Name 31 character limit 
the remote analyzer on the central 

console’s screen. 

Baud rate 300 baud | Specifies the serial line baud rate. 

1200 baud 

38400 baud | (38400 baud not recommended.) 


Specifies a symbolic name that identifies 
Figure 6. Options available on the remote analyzer configuration menu. 


Color option 


Select this option if you intend to run the remote analyzer with a color monitor on 
the central console. Use the up cursor (7 ) to move the highlight up to the menu 
item, and press the Spacebar. A check mark (v ) replaces the x to the left of the 
item to indicate that you selected the item. 


Password option 


The password option on the remote console configuration menu provides one of 
two forms of security for your SniffMaster I system. The password you specify in 
the remote analyzer’s menu must match the password entered at the central 
console. (For more on how using this option, see the section, “Editing the 
.rootmenu file.”) 


To record the password for this remote analyzer, use the up or down cursor key to 
move the highlight to the password menu item, and press Enter. Type ina 
password with no more than 31 characters, and press Enter to accept it. 


The second form of security includes disabling the remote analyzer’s keyboard and 
screen from the central console. By this means, you can still see at the central 
console what the remote analyzer sees, but a person by the remote analyzer will 
see nothing and cannot tamper with the analyzer through the keyboard. (See the 
section, “Setting SniffMaster I Options at the Central Console.”) 


Name option 


The name option gives you a way to identify clearly each remote analyzer 
represented on the central console’s screen. After installing several remote 
analyzers to your system, you will see each one through SunView windows on the 
screen. If you have many windows opened for many remote analyzers, the central 
console screen will become cluttered. It could be difficult to recognize each remote 
analyzer quickly without some type of memory aid. 
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To record a name for a remote analyzer, use the up or down cursor key to move 
the highlight to the name menu item, and press Enter. Type in a name with no 
more than 31 characters, and press Enter to accept it. 


When you supply a symbolic name with this option, the central console will use it 
to identify each remote analyzer on its screen. The name will appear in the window 
frame header surrounding the remote analyzer screen and as a label on the icon for 
that remote analyzer (see Figure 19).1 


Baud rate option 


To set the baud rate, press the right cursor key (* ) when the highlight is on the 
baud rate menu item. The menu panel with the seven baud rate choices will move 
to the center. Use the up and down cursor keys to move the highlight to the one 
you want, and press Enter. The pointer ( |» ) in the vertical bar to the left of the 
choices will move to your preference. 


Saving the configuration 


To save the configuration, press F7. This action will replace the defaults and will 
remain in effect until you reconfigure the remote analyzer. 


Installing SniffMaster | remote analyzer software 


The next step is to install the SniffMaster I remote analyzer software. First, you exit 
the remote analyzer configuration menu, You will once again see the SniffMaster 
I remote analyzer selection menu (see Figure 4) and can now install the 
SniffMaster I TSR program. It runs concurrently with the Sniffer analyzer. Move 
the highlight with the cursor key to the option, install remote analyzer, and press 
Enter. 


After you install the remote analyzer software, the main selection menu will 
return (see Figure 3). This indicates that you successfully loaded the TSR program. 


Unloading the SniffMaster | remote analyzer software 


To unload the remote analyzer software, select the SniffMaster I remote analyzer 
item on the main selection menu to return to the SniffMaster I remote analyzer 
selection menu. You see a menu like the one show in Figure 7. Select the remove 
remote analyzer item, and press Enter. 


1 Window frame header and icon are SunView terminology. See the SunView Beginner’s Guide for more information. 
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Snifffaster I Remote Analyzer Selection 


Remove Remote Analyzer 


Return to main menu 


Remove and terminate the SniffMaster I 
Remote Analyzer 
Use arrow keys to select, then press Ente 


Figure 7. SniffMaster I remote analyzer selection menu. 


Setting up Terminal Servers 


Set up the connection between the remote Sniffer analyzers and their respective 
terminal servers before going any further. 


Any number of available terminal servers may be used in the SniffMaster I system. 
NGC has tested four that work successfully with the system. Follow the 
installation instructions in the manual accompanying the terminal server you 
choose. 


You must configure the TTY port of the terminal server to which you attach the 
remote analyzer. The central console establishes a connection to the terminal 
server's Internet Protocol (IP) address and the TCP port number of the TTY port. 
Many terminal servers allow you to specify a network port number that relates to 
the individual terminal server’s RS-232 port. For most RS-232 connections, this port 
is set at 23 by default, the Telnet server port. But you must set up a direct TCP 
connection on a port that is not well-known. 


NGC recommends that you assign port numbers in the 3000 range. In the IP world, 
port numbers below 1024 are well-known and should not be used for SniffMaster I 
purposes. 


The terminal server baud rate must agree with the remote console’s baud rate that 
you set in the configuration procedure. 


You need the port number and the configuration of each remote analyzer when 
you set up the central console. 


In each section below, you can find example configurations that NGC found to 
function acceptably. 


Interlan NTS200 


The Interlan NTS200 is easy to install. Figure 8 shows an example configuration for 
a TTY port for an Interlan NTS200 terminal server. You need simply to enter the 
values on the terminal server configuration menu. 
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Machine interface 
Figure 8. Example configuration for an Interlan NTS200 terminal server. 


Hughes LAN Systems 4208 


The Hughes LAN Systems 4208 terminal server has 8 serial ports and multiplexes 
one Ethernet connection into 8 RS-232 connections. The HLS 4208 works well with 
the default settings. If you have questions about configuring the HLS 4208, refer to 
the HLS LINC/Term Multiple Protocol Software for Terminal Servers: Network 
Manager's Guide to Operations. 


The only thing you need to do is determine the TCP port number that you will 
need when you configure the central console. First, you look at the number of the 
serial port that you intend to use. They are numbered 1 to 8. Then you add 7000 to 
it. Thus, if you have serial port number 3, the TCP port number is 7003. 


cisco System ASM 


The cisco System ASM terminal server has the ability to manage 40 terminals. You 
connect through a cable harness of 10 25-pin D-connectors to one telco connector. 
There are four telco connectors on the back of the ASM unit labeled with the 
appropriate range of serial port numbers for that connector. 


The terminal server comes with a manual entitled Terminal Server Manual. It also 
contains two addenda: “cisco Systems Terminal Server Update” and “Release 7.0 
Documentation Update.” You will find the set up and configuration for the 
terminal server described in these documents. 


In the majority of cases, SniffMaster I will operate with a pre-installed cisco 
terminal server. In these cases the server has already been configured for IP 
addressing. Consult Chapter 4 of the cisco Systems Terminal Server Manual for 
information on unpacking and starting the terminal server. 
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The procedures and suggestions detailed in this document are solely meant as 
examples for configuring a cisco System ASM terminal server. 


Installation procedures 


Establish a connection to the ASM terminal server console port via the RS-232 
serial port connector. This is a 25-pin D connector located on the back of the ASM 
unit in close proximity to the transceiver connector. The port will generally be set 
at 9600 baud. Attach your terminal (or PC if you are using kermit or another PC 
terminal emulator), and press the Enter key twice. A prompt such as the following 
should appear: 


TS> 


The example below illustrates the configuration of an ASM server used in 
conjunction with the SniffMaster I system. The prompts and their respective 
responses are noted on the the left hand side of the page. All characters including 
and following the ‘;’ character are comments describing the configuration 
condition. 


TS>enable ; Gains access to the terminal 
; server commands. 


; At this point, you may want 
; to view the configuration of 
; the terminal server as it 


; exists. 

TS> show configuration 

TS#configure ; Enters command collection 
; mode for configuring the 
; system. 


Configuring from terminal, memory, or network [terminal]? terminal 


Edit with DELETE, CTRL/W, and CTRL/U; end with CTRL/Z; abort with 
CTRL/C: 


interface ethernet 0 ; If IP addressing is required, 
; set up for using 
; subcommands. 
ip address YY.YY.YY.YY 22.22.22.22 ; Where YYs = new IP address 


sand ZZs = subnet mask 
; e.g., 295.259.0.0. 


For interface Ethernet0, current address XX.XX.XX.XX disagrees with new 
address YY.YY.YY.YY using new address. 


line 17 ; Configure serial lines 1 to 7 
; for SniffMaster I. 
; Line numbers will differ by 
; installation. 


no login string 
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no activation-character 


no autobaud ; Baud rate will be known 
; from the remote analyzer’s 
; SniffMaster I configuration. 


no disconnect-character 
databits 8 
no escape-character 
no exec 
no hold-character 
no login 
no notify 
no pad 
parity none 
no password 
no rotary 
no session-timeout 
speed 19200 ; Enter the baud rate 
; corresponding to the remote 
; analyzer’s. 
stop bits 1 
CTRL/Z 


You may not want to enter the next step until you have tested this 
configuration. See the subsection, “Testing the connection.” 


write memory ; Save the configuration. 


write 


Testing the connection 


After configuring the terminal server, you will want to test the connection. Attach 
a remote Sniffer analyzer to a terminal server line that you’ve configured. (The 
most common connection is a 9-pin to 25-pin serial cable.) Ensure that the analyzer 
is configured for SniffMaster I use. Select the configure remote analyzer item on 
the SniffMaster I remote analyzer selection menu (Figure 4). 


From the SniffMaster I central console, enter a line such as the following: 


snifftool XX.XX.XX.XX 40pp ; XX.XX.XX.XX = IP address of configured 
; terminal server. 
; pp = serial line number to which the Sniffer 
; analyzer is attached. (01, 02, xx). 


The central console should open a remote analyzer window indicating a properly 
configured system. 
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The ASM terminal server will treat port numbers of 4000 plus the line number as a 
raw TCP stream. Hence, terminal server 4 connection will be addressed as port 
4004 decimal. 


Configuring the central console 


Once you've tested and saved your terminal server configuration, you'll need to 
configure the central console. When you get to that phase of installing the 
SniffMaster I system, be sure to add the line, ka 90, to the central console’s 
/etc/rsniff.config file. 


3Com Series 200-TCP 


The 3Com Series/210 terminal server has 10 RS-232 ports on the back marked JOC-— 
Joc. An Ethernet transceiver connector is also located on the rear panel of the unit. 
The terminal server examined by NGC had a floppy disk labeled: 


PART NO. — 83-0102-04 
SERIAL NO. XXX 
PRODUCT = CS/210 
TYPE SW/200-TCP 
VERSION NO. 3.2 


Following are the installation steps worked out by NGC: 
Starting the monitor program 


Most terminal servers to be used in the SniffMaster I system are pre-existing 
servers used for existing terminal/ printer devices. To add a SniffMaster I central 
console connection, you must reconfigure the terminal server through the monitor 
console. 


The monitor console is the connection marked JOC. In some cases, connecting a 
terminal to JOC and resetting the terminal server will result in the monitor being 
active on that port. However, in other cases, the monitor needs to be enabled by 
resetting the unit using the reset button recessed in the lower left side of the unit, 
connecting a terminal to JOC, and depressing the terminal’s C/R-Enter key. 


A message such as the following will appear: 


Bridge Communication Series/210 Monitor 
> 


Booting the config utility 

Insert the boot floppy in the terminal server, and enter the command 
bt 1d 

at the monitor prompt to boot from the floppy disk. 


The screen will clear, and the following menu will appear: 
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Sysgen Utility v2.0 
1. View/Alter Module Parameters 
2. Save Parameters 
3. Exit to Monitor 
Enter Selection: 


Enter a 1 to configure the terminal server for the SniffMaster I system. Next you 
will see the following menu: 


Module Select Menu 
- Kernel Parameters 
- Data Link Parameters 
IP Parameters 
TCP Parameters 
. User Interface Parameters 
. Virtual Terminal Parameters 
Statistics Monitoring Parameters 
. Service Listener Port List 
Access Control Parameters 
- Remote Access Parameters 
(Esc to return to main menu) 
Select module: 


PUD WIKHU FWNHH 
. . 


If your terminal server is already connected and has an IP address, skip to the step, 
“Adding a service listener port.” 


To set up a simple demonstration connection from a non-configured system, 
continue with the next step, “Establishing an IP address.” 


Refer to 3Com’s TCP/IP Connection Service User's Guide for a permanent connection 
and further instructions. 


Establishing an IP address 


To establish an IP addressAfter you enter a 3 at the module select menu. You will 
see the following menu: 


IP Parameters 


Parameter Current Value 
1. Network to IP mailbox 0x20 
2. Client to IP mailbox 0xc 
3. Server Internet Address 0O#.0#.0#.0# 
4. Server Subnet mask not a subnet 
5. IP Option Handling Parameter 


(Esc to return to main menu) 
Select module: 


Enter a 3 at the IP Parameters menu. 


The next message is: 
Enter Server address (x.x.x.x): 


Enter the address desired for this terminal server. 


The next message is: 
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Enter subnet mask -- X to clear(none): 

Enter a mask, or press C/R-Enter key to continue. 

After the address is set, press Esc to return to module select menu. 
Adding a service listener port 


The SniffMaster I central console communicates with the remote analyzer via one 
of the RS-232 ports on the terminal server. Each port must be assigned its own IP 
address and port number. This assignment keeps the terminal server from rejecting 
the non-Telnet TCP port connection requests. The central console TCP port is user- 
selectable and not a well-known number. NGC uses the port address 3208 as a 
default TCP port number for TCP connections. 


You will set the IP address for the port as part of the procedure for exiting the 
monitor described in the next section. 


To add the central console port number, enter 8, service listener port list, on the 
module select menu. You'll see the following menu: 
Service Listener Well Known Ports 

| ae 

2. 513( 201) 

3. (Add new Service here) 

(Esc to return to main menu) 

Select module: 


Enter 3 to select the item, add new service here. 
The next message is 
Enter well-known port number (or 0 to clear) 


To use the default SniffMaster I central console port, enter 3208. Otherwise, enter 
the port number of your choice , and use it in the next step. 


Exiting the monitor 


After the port number is selected, depress the Esc key twice to return to the Sysgen 
utility menu. Then enter a 2 to save parameters. The question, are you sure?, will 


appear. Enter a “y” for yes. The message, saving new configuration, will appear 
momentarily. Enter a “3” to exit the monitor. The prompt should now appear. 


Reset your terminal server using the reset switch on the terminal server’s front 
panel. 


Switch the terminal connector to its original connection. In our example, we use 
the JIC connector. 


After the system has reset, use the following key sequence: 


C/R -Enter . C/R-Enter 
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Now you should see the following message: 


Welcome to your Comm Server 
CS/210T> 


Change to global network manager privilege level by entering: 
set priv=gnm 


Pick the RS-232 port for SniffMaster I use. Our example uses port 4. Set the port to 
be used as a host port, the baud rate, the IP address of the port to the one you 
require, flowcontrol in only one direction (accept XON/XOFF) by using the 
following command and accompanying arguments: 


setd (!4) dv=host ba=19.2 ip=XX.XX.XX.XX FCT=none 
Testing the configuration 
Attach a Sniffer remote analyzer serial port to a terminal server line that has been 


configured through the above steps. (The most common connection is a 9-pin to 
25-pin serial cable.) 


Ensure that the Sniffer remote analyzer is configured for SniffMaster I use. (Select 
the configure remote analyzer item on the SniffMaster I remote analyzer 
selection menu (see Figure 4.) 


From the SniffMaster I console, enter a line such as the following 
snifftool XX.XX.XX.XX 3208 


In the example above, XX.XX.XX.XX is the IP address of configured serial port for a 
SniffMaster I connection and 3208 is its port number. 


The SniffMaster central console should open a remote analyzer window indicating 
a properly configured system. 


Setting up a Central Console 


Logging on 


The following instructions assume that you've attached a Sun workstation to its 
network segment. Now you want to set it up as a SniffMaster I central console to 
communicate with terminal servers and, in turn, with all the remote Sniffer 
analyzers. 


Loading SniffMaster I software requires root privileges on the Sun workstation. 
Obtain this privilege before continuing. 


Because the UNIX operating system running on the Sun workstation can be used 
by many people at the same time, it must be able to differentiate between you and 
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other users. You must identify yourself before the UNIX system will process your 
requests. 


The first thing you should see is the login prompt of the Sun workstation. At the 
prompt, type 


root 


and press Return. Next you will be prompted for a password. Type the root 
password, and press Return. 


At this point, you will see a message and a prompt when you successfully log on. 
The message is called the “message of the day.” 


Loading SniffMaster | central console software 


Your SniffMaster I central console software comes on a tape. To begin loading it to 
your Sun workstation, type the “change directory” command 


cd / 
and press Return. 


Next put the tape into the appropriate drive. Type 
tar xvf /dev/rst0 


and press Return. This command will create the sniffmaster directory that 
contains the text and binary files need to run snifftool. The placement of binary 
and configuration text files in the sniffmaster subdirectory allows for advanced 
custom installations using the RSNIFF environment variable and the entries in the 
configuration file. 


After the tar command has completed its operation, perform the following steps: 
cd /sniffmaster 
cp etc/* /etc 


For the next command, use sun3 if you are using a Sun 3 system. Use sun4 if you 
are using a SPARCstation. 


cp [sun3 | sun4]/bin/snifftool /bin/snifftool 


You’ve now installed the SniffMaster I central console software. 


Bringing up SunView 


The next step is to set some basic options at the central console. If you haven't 
already, you must first bring up SunView, a window-based environment that lets 
you run SunOS tools. Each tool has its own SunView “window” or “frame.” 


eat 2 
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<¢ CONSOLE >> 


SunView lets you see several directories or files, or run several commands, at the 
same time. 


At the prompt, type 
sunview 


and press Return. 


Now you are in the SunView environment. Figure 9 shows you a typical SunView 
screen. You can see the parts of a SunView screen that you will use when running 
the SniffMaster I system from the central console. For detailed information about 
the SunView screen, see SunView I Beginner’s Guide. 


Figure 9. SunView screen showing significant parts: console frame, icons, root area, and so 
on. 


The grey background in the figure is known as the root area of the SunView 
interface. In the upper left-hand corner of the figure is the console frame (see the 
next section). The four items just to the right of the console frame are icons. 


The console frame 


It is always a good idea to leave on the screen the console frame that opens upon 
startup. The console frame displays messages from SunView and Sun OS. For 
example, if you have network problems, it traps error messages from the system 
that may disrupt your screen and Sniffer sessions. 


Sometimes you or someone else may close or quit the console frame. If you close it, 
the console frame will be represented as an icon on the screen (see Figure 10 
below). 
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Figure 10. SunView console frame icon. 


To reopen the console frame, place the mouse pointer on the console frame icon, 
and click the left mouse button. 


If for some reason you quit the console frame, put the mouse pointer anywhere in 
the root area, and hold down right button. When the root menu appears, keep 
pressing the right mouse button while you pull the pointer down to the menu 
item, shells. Keeping the right mouse button down, pull the pointer to the right 
until you see the shells submenu with the console item (see Figure 11). While the 
pointer is over the console menu item, lift up on the mouse button. A console 
frame will appear. 


Sniffers > 

Shells Command Tool 
Editors Shell Tool 
Tools Graphics Tool 


Services Console 


Figure 11. The root menu and the shells submenu. 


Place the console frame at the top of the screen and out of the way as you see in 
Figure 9. You move and resize the frame using the frame menu (see Figure 17). See 
the SunView I Beginner’s Guide for directions on moving and resizing. 


Checking, changing, and examining directories 


Before going any further, it may be valuable to check to make certain which 
directory you are in and to change directories if necessary. Also you may want to 
read the latest information on the SniffMaster I system in the README file. 


To check the directory, you first open a command tool frame by putting the 
pointer in the root area and holding down the right button. While you still hold the 
right mouse button down, move the mouse pointer down to the menu item, shells, 
and then pull it right to the menu item, command tool (see Figure 11). 
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pw 
sniffmaster 


Figure 12. SunView command tool frame. 


Now lift up the right mouse button, and a command tool frame appears (see 
Figure 12). To check what directory you are in. Type 


pwd 

and press Return. The central console should say 
/sniffmaster 

If you are in some other directory, change directories by typing 
ed /sniffmaster 

and pressing Return. 

To examine directory contents, type 
ls -la 

and press Return. 


Figure 13 lists the SniffMaster I directories and files at the central console: 
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/sniffmaster | README A note containing up-to-date 
information about the SniffMaster I 
.rootmenu.example | A sample rootmenu configuration file. 
This gives you an idea about how to set 
the real .rootmenu file. 


/bin snifftool The SunView application that runs on 
the central console. 


A sample snifftools configuration file. 


[font.big | Large type font. 
[gont.small ___—_—| Small type font. 
[font.very.small __| Very small type font. 


Figure 13. SniffMaster I directories and files at the central console. 


The README file you see listed in the directory contains additional and up-to- 
date documentation. To read the README file, type 


more README 


at the prompt, and press Return. 


Editing the .rootmenu file 


You use the root menu to add SunView windows displaying remote analyzers to 
the central console monitor. The next step is to add menu items to the root menu. 
This will then let you invoke SunView frames containing views of the remote 
analyzers on your system. Figure 14 shows an example of how remote analyzers 
will be listed on a submenu of the root menu. 


Sniffers 
shells 
Editors 


Tools 
services 
Exit Sun¥iew 


Figure 14. The Sniffers menu and the LAB submenu listing four analyzers: Port2, Port4, 
Port6, and Port8. 


To do the editing, open a command tool frame by first putting the pointer in the 
root area and holding down the right button. While you still hold the right mouse 
button down, move the mouse pointer down to the menu item, shells, and then 
pull it right to the menu item, command tool (see Figure 12). 


Now lift up the right mouse button, and a command tool frame appears. Check to 
see what directory you are in. The .rootmenu file will be in either the $HOME 
directory or the /usr/1lib directory. 


SniffMaster | Installation and Operations Manual 


To edit the .rootmenu file, type 
vi .rootmenu 


at the prompt, and press Return. Now you should see an editable version of the 
.rootmenu file. You can now use the Unix visual-interactive editor to configure the 
root menu. 


“Sniffers” MENU 
“LAB” MENU 
“Port2” snifftool 118.18.4.9 9298 
“Port4” snifftool ts 3207 
“Porté6” snifftool ts 3206 -password sesame 
“Port8” snifftool /dev/ttya -baud 9600 
“LAB” END 
“Sniffers” END 


Figure 15. An editable .rootmenu file and a configured root menu. 


Basically, what you must do is add items to the root menu that will let you 
regularly start up remote analyzers and display their screens on the central 
console’s monitor. Figure 15 shows an example of a configured root menu. Figure 
14 shows the result of the edits. 


In the example, the first-level menu was named Sniffers on the first and last lines. 
Enclose the menu item name in quotes. Follow the first instance of the name with 
MENU (use all upper case), and follow the second instance of the menu name with 
END. 


The submenu was named LAB. The format of submenu names is the same as for 
menu names. Remote analyzers grouped in this way on submenus can represent 
logical or functional distinctions that are important to your system. 


The four menu items on the LAB submenu—Port2, Port4, and so on—represent 
the four middle lines in the .rootmenu file. They are names for four different 
remote analyzers. Following each name in the .rootmenu file, you see the 
command followed by several different kinds of argument that takes the following 
general format: 


snifftool [IP address | /device] [port number] -password [passwordname] -baud [rate] 


Always begin with the command, snifftool. The arguments that follow can vary: 


[IP address | /device] The complete IP address or device name of the terminal server. If 


you ve attached the remote analyzer to a port on the central 
console, then use the IP address of the central console. You can also 
substitute an alias. As you can see in Figure 15, the terminal server 
for the remote analyzer, Port2, has an IP address of 118.18.4.9. 
Port4 and Porté have the alias, ts. Ports has the alias, sm. 


If you use a device name, provide the absolute path name to the 
device starting at the root and with a slash, /. Figure 15 shows the 
absolute path name as /dev/ttya. 
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[port number] 


-password [passwordname ] 


-baud [rate] 


The port number of the terminal server or central console to which 
you attached the remote analyzer. 


Figure 15 shows a port number of 9298 for the terminal server 
connecting Port2. 


The remote analyzer’s password. 


In Figure 15, look at the entry for the terminal server connecting 
Porté. The third argument in that line, -password, automatically 
enters the password, sesame. 


If you don’t want the password entered automatically, don’t use 
this argument. If the remote analyzer was set up with a password, 
you ll be prompted for that password upon selecting a remote 
analyzer from the root menu. If the remote analyzer was not set up 
with a password, the connection will occur automatically. 


Baud rate when connecting to a port on the central console. When 
you want to connect the remote analyzer to a port on the central 
console, use -baud. 


Port8 in Figure 15 has the baud rate set to 9600. 
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Chapter Overview 


Chapter 3 describes how to operate the SniffMaster I system. There is not much 
more to its operation. First you open windows (also known as “frames” in the 
SunView system) on the central console with views of remote analyzers. Then set 
your preferences for each frame from its options menu. 


From then on, you run each remote unit just like you would a Sniffer analyzer. 
There are a few differences, however. Because of the SniffMaster I system, several 
enhancements to the Sniffer analyzer itself make it an even more useful and easy- 
to-use tool for network analysis, monitoring, and troubleshooting. 


Starting Remote Analyzers at the Central Console 


To start a remote analyzer, place the pointer in the root area, and hold the right 
mouse button down. When you see the root menu, pull the pointer down until it 
points to the Sniffers item. Keeping the mouse button down, pull right until you 
come to a submenu containing the list of remote analyzers you want. Pull the 
pointer down to the remote analyzer on the list that you want, and lift up on the 
mouse button. 


After the frame opens, you see the Sniffer analyzer main selection menu visible in 
Figure 16. To start one of the Sniffers listed on the menu, use a cursor key to select 
desired Sniffer, and press Return. 


SniffMaster I (tm): LAB_LEND 
[ee 


The Sniffer Network Analyzer 
(C) Copyright 1986-1996, Network General Corporation 
ain selection menu 


Ethernet Analyzer Internal plasma display 
Ethernet Analyzer External color monitor 
Token-Ring(4/16) Analyzer External LCD projector 
Ethernet Monitor 3 Return to DOS 
SniffMaster I Remote Analyzer System shutdown 
TeleSniffer 

Configuration Utility 


Suites: IBM, Novell, XNS/MSNET, TCP/IP, SUN, AppleTalk 


Use arrow keys to select, then press Enter. 


Figure 16. SunView window frame with Sniffer screen showing main selection menu. 
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To use the keyboard to run the analyzer or to set options for that frame, move the 
arrow cursor into the SunView frame. The frame border will turn from a double 
line to a thick solid line. The frame is now active. 


When you open several analyzers, use the options in the frame menu to arrange 
your monitoring and analyzing tools on the screen. Figure 17 below shows the 
frame menu that you pull down by position the arrow cursor on the frame header, 
holding down the right mouse button, and lifting the button up on the item of your 


choice. 


SniffMaster I (tm) 


A 
wkGn1626E39 
Sparta 
ntr1n8S91A2 
ngc 
un 676A83 
ynOpt819998 
xce1n923931 
Com 6C3734 
ntr 1n82B387 
ntr 1 n6@4F4CC 
ntr 1n@3C82F 
ntr1n6592BC 
ntr1n6@6F16B 
ntr1n6@3E711 
ntr 1n6Z2BHEB 
ntr 1n66F64D 

2479 Good 


2479 Frames 


bldg2 


Intr 1n@6A8ED 
Exce 1n933289 
Intr 1n@46E28 
Intr 1n862CBC 
Intr1n647826 
Intr 1n86E53A 
NwkGn1626C3A 


Resize C trained : 
Front ™ ee 
Back 

Props 

Redisplay | 

Quit : 


Bad CRC 6 Lost 
9% Buffer utilization 


168 


Frames per second 


Figure 17. SunView frame menu listing options. 


Repeat each of the steps above for each analyzer with which you want to work. 


36 


Chapter 3. Operation of the SniffMaster | System 


CONSOLE >> 
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ffMaster I (tm): LAB_END 
BD: men a9 . a 
f2|-GLOBAL STATIST1C¢S—————____________________—_fpr 27 @8: 


Traffic Counts 


Total Stations Active Stations 
fverage Usage - y Current Usage 
Total Frames Current Frames 
Total Bytes Current Bytes 
fvg Frame Size fvg Frame Size 


Error Counts Timestamps 


CRC Errors Monitor Started Apr 27 
Alignment Errors Monitor Active @ day(s) 
Total Frame Errors 

First Activity Apr 27 
Unsaved Framos Last Activity Apr 27 
Missed Frames Network Active B day(s) 
Count Overf lows 


5 6Disply 9Freeze 16 Stop 
Menus options display monitor 


33724 Good @ Fragments 6 Misaligned @ Bad CRC 
33724 Frames accepted t 66x Buffer utilization 


Figure 18. SunView with Sniffer screens showing advanced network monitoring and a 
capture display. 


Figure 18 shows a Sniffer analyzer and a monitor displayed on the central console. 


When you use the frame header menu to close the frame, you'll see an icon like the 
one shown in Figure 19. Selecting the icon and holding down the right mouse key 
will open a menu like you see in the figure. The menu has a listing of options 
similar to that in Figure 17. You can use the menu to open the frame again or to 
quit the remote analyzer altogether. 
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Move > 
Resize > 


Front 
Back 
Props 
Redisplay 


Figure 19. A Sniffer icon. 


Setting SniffMaster | Options at the Central Console 


At the central console, you can set a number of SniffMaster I options that affect 
both the central console and the remote analyzer. 


SniffMaster | central console options menu 


There is one central console options menu for each Sniffer analyzer you have 
running. To open the central console options menu for a particular Sniffer, first 
move the arrow cursor so that it is within the frame containing the view of the 
Sniffer you want to work with. You open the central console options menu for that 
particular Sniffer in one of two ways: 


props key You will find the props key among the function keys on the left-hand side 
of the keyboard. Upon pressing the key, you see the central console options 
menu. 


frame menu One item on the frame header menu (see Figure 17) is props. To get the 
menu, move the pointer over the frame header of the frame showing the 
Sniffer session you want to alter. Hold down the right mouse button. While 
holding the right mouse button down, pull the pointer down the frame 
menu until you reach the props item, and then lift up on the button. The 
central console options menu will open. 
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Abs Time DST——————-SR, SUMMARY——Abs Time DST 
15:56:480.1157 Sparta : : : Sparta 
15:51:25.9428 Sparta i 4 a Sparta 
15:51:25.9439 3com : 225. 3com 
15:52:11.7692 Sparta H : . Sparta 
15:52:11.77862 3com : : F 3com 

Frame 758 of 15719 


SniffMaster I Control Console Options 


Display type: © Black on White 


Display update mode: Immediate 


Sniffer size: © 88 cols x 25 rows 
Font size: #& Normal 


Remote keyboard is: © Enabled 
Remote screen is: © Enabled 


Print to file: 


a 
Full Screen 


Figure 20. SunView with a SniffMaster I central console options menu. 


The central console options menu (see Figure 20) offers three methods for entering 
choices: 


* Clicking a cycle item. 
* Clicking a panel button. 
¢ Typing in directory and file names. 


Clicking a cycle item 


One method is the cycle item which looks like two arrows going around in a circle 
and follows a menu item. 


o 


A cycle item lets you “cycle” through a set of choices until you come to your 
preferred choice. You do that by placing the pointer on the cycle item and by 
clicking it with the left mouse button. The complete set of choices for each item is 
visible in a pull-right menu. 


To view the list of choices and to make a choice from the list, place the pointer on 
the cycle item, and hold down the right mouse button. When the menu appears, 
keep the mouse button down, pull the pointer down to your choice, and lift up on 
the mouse button. 
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Figure 21 below lists each menu item on the central console options menu, the 
choices selectable by a cycle item, and the purpose of the choice. 


[Menultem [Choice —s—'([Purpose, 
Display type Updates both background and foreground 
color attributes. Slow screen refresh. 
Faster screen refresh. 


Immediate Preferred; however, some characters get 
overwritten. 


Faster screen update, but because it uses 


more memory, can slow down other 
80 columns x 25} Small screen size; default size. 


Display update 
mode 


applications. 


Remote Sniffer 
analyzer screen 
size 


100 columns x_ | Middle screen size. 


40 rows 


120 columns x__| Large screen size. 
60 rows 


keyba 
keyboard is from its own keyboard. 
keystrokes from its own keyboard. 
Enabled Remote analyzer screen display is visible. 


Disabled Remote analyzer screen display is not visible. 


Figure 21. Choices available on the SniffMaster I central console options menu. 


NOTE: To see the 
result, go back to the 
main menu before 
displaying the data. 


Font size 


Remote screen 
is 


Clicking a panel button 


The second method for making a choice on the central console options menu is the 
panel button. There are six labeled panel buttons at the bottom of the central 
console options menu. The six panel buttons are visible on Figure 20 and described 
in Figure 22. 
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[Panel Button [Purpose 


Resume / Start and stop screen updates. 
Suspend 


End this Sniffer connection. 


Figure 22. Panel buttons on the central console options menu. 


To choose an option indicated by a panel button label, move the pointer to the 
panel button, and click the left mouse button. 


Clicking the information panel button displays SniffMaster I system information 
(see Figure 23 below). 


SniffMaster I (tm): LAB_EN 


Time DST——————_SR, SUMMARY. Abs Time DST 
15:58:48.1157 Sparta 758 15:50:40.1157 Sparta 
15:51:25.9428 Sparta 4231 15:51:25.9428 Sparta 


SniffMaster I version @.9.9a Beta 
Copyright 1998, Network General Corporation. 


Display dimensions are 8@ x 25 
Messages: 15 outgoing, 62 incoming (@ errors) 


Remote name = LAB_END 

Remote host = athens 

Port number = 3208 

Configuration File = /etc/rsniff.config 
Alarm level = @ 


Print to file: 


Figure 23. SnifffMaster I system information box. 


Printing to a file 


The third method of making a choice is to enter the required information directly 
into a field when you want to print to a file. In Figure 20, look at the item, Print to 
file:, just above the panel buttons. 
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Print to file /directory/file | Transfers a printable trace file from a remote 
name analyzer to the central console. Remember 


to configure remote analyzer to redirect 
output and to set the Display /Print 
submenu. 


Figure 24. Print to file option available on the SniffMaster I central console options menu. 


To print to a file, you must first configure the remote analyzer to redirect output to 
a file. You do that on the Sniffer display/print submenu (see Figure 25). Then use 
the field at the bottom of the central console options menu to enter the directory 
and the name of the file to which you want to print. Press Return to complete the 
operation. 


SniffMaster I (tm): LAB_EN 


Summary 
Detail t+To last frame 
Hex To frame 1 
Two viewports 

Device LPT1 
Filters Device COM1 
Print >File 
Manage names 

x Delimited format 


VY Print page titles 
Page size = 5@ 


Print to file. 


=—=Press SPACE to select this option, or ENTER to do it 


Figure 25. Sniffer display/print submenu. 


Sniffer Features Unique to SniffMaster | 
With large monitor on the central console and the addition of a mouse, several 
other features have been implemented for the Sniffer analyzer. 

Five skylines histograms 
If you select the skylines option for the real-time display in the capture/skylines 
submenu, you see five histograms representing five different types of network 


information (see Figure 26): 


Kbytes Shows the number of kilobytes being captured with a time interval and 
with unit sizes that you set. 
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frames Shows the number of frames being captured within a time interval and 
with unit sizes that you specify. 


Brdcst Shows the number of broadcast frames. 
errors Shows the number of frames with errors. 


#stns Shows the number of stations active, i.e., stations that have sent frames in 
the given interval and in selected unit sizes. 


SnifiMaster I (tmj: LABLENE 


572S Good 6 Frag @ Misaligned @ Bad CRC @ Lost 
5725 Frames accepted cue tZ,Kbytes accepted 23% Buffer utilization 


+ t 1 
38 188 368 1888 3088 
Frames per second 


8 
2Select| 4 Clear iS Scale} i? View 8 View 18 Stop 
display) screen up learlier| later capture! 


1 1 


Figure 26. Real-time capture display showing five histograms visible with the SniffMaster I 
system. 


More network information visible in Sniffer screen 


When you use the SniffMaster I central console options menu, your choice of 
remote analyzer screen size and font size affects how much network information is 
actually visible on the screen. For example, if you choose the normal font size with 
120 columns and 60 rows in a summary view, you will see 55 summary lines that 
extend the width of the screen, if they have that much information. 
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Clickable function key buttons 


The function keys on any Sniffer screen are clickable with the mouse. To “push” 
the function key button, move the pointer into the frame with the Sniffer screen 
you are interested in. Click the function key button with the left mouse button. 


Using special keys and key sequences on the Sun keyboard 


You will use some special keys on the Sun keyboard that do not exist on the 
standard PC keyboard. Also some of the key sequences differ from a standard 
Sniffer analyzer. 


@ Spacebar The diamond keys (also known as Meta keys in SunView terminology) serve 
the same purpose as the Alt key on the PC keyboard. You use a diamond 
key in combination with some other key. For example, to change all the 
options in a Sniffer submenu list from all checks to all x’s (or vice versa), 
you press Alt Spacebar. To perform the same operation from a central 
console, you press @ Spacebar. 


Esc Esc The equivalent of the Esc key on the remote analyzer is to press the Esc key 
on the central console twice. 


Help Redraws the screen on the central console. 


+ Help + Reboots the remote analyzer from the central console. 


4a (ses) 
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Index 


Index 


$HOME directory 29 
+ key 44 


.rootmenu file 28, 29 
example 29 


/bin directory 28, 29 
/ device 30 
/etc directory 28, 29 


/sniffmaster directory 28, 
29 


/usr/lib directory 29 


3Com Series 210-TCP 
config utility 21 
monitor program 21 
terminal server 
configuration 21 
test procedure for 
connection 24 


address 
IP 17, 23, 30 
port 23 


alias 30 
Alt key 44 


analyzer 

main selection menu 
13, 35 

remote analyzer 
configuration 
menu 14 

starting at central 
console 35 


asynchronous 
communications 
SniffMaster I system 6 


baud rate 30, 31 
menu item 15, 16 

Brdcst counter 43 

broadcast counter 43 


button 
function key 44 
mouse 27 
capture display 
histograms 42 
skylines 42 


cd 
change directory 
command 25, 28 


central console 
configuration 21 
loading SniffMaster I 
software 25 
options menu 38 


role in SniffMaster I 
system 6 

setting option 25 

setting options 38 

setup 24 

starting Sniffer 
analyzer 35 

summary view 43 


central console options 
menu 38 
cycle item 39 
opening 38 
panel button 40 
centralized management of 
LANs 7 


change directory command 
25, 28 


check directory command 
28 


Cisco System ASM 
terminal server 
configuration 18, 
19 
test procedure for 
connection 20 


color console 
menu item 15 


command tool 
menu item 27, 29 


command tool frame 27, 29 


commands 
cd 25, 28 
ls 28 
more 29 
pwd 28 
snifftool 30 
vi 30 
configuration 
3Com Series 210-TCP 
21 
central console 21, 24 
Cisco System ASM 18, 
19 
Hughes LAN Systems 
4208 18 
Interlan NTS200 17 
remote analyzer 13 
SniffMaster I system 6 
terminal servers 17 


configure remote analyzer 
menu item 14 

console 
frame 27 
menu item 27 


console frame 


function 26 
icon 26 
SunView interface 26, 


counter 
broadcast 43 
errors 43 
frames 43 
Kbytes 42 
number of stations 43 


cycle item 
central console options 
menu 39 


device name 30 
diamond key 44 


directory 
$HOME 29 
/bin 28, 29 
/etc 28, 29 
/sniffmaster 28, 29 
/ usr/lib 29 
changing 28 
checking 27, 28 
listing files 28 
root 25 
sniffmaster 28 
SniffMaster I 
directories 28, 29 
display type 
menu item 40 
display update mode 
menu item 40 


documentation 
SniffMaster I system 9 


editor 
visual-interactive 30 


error messages 
SunOS 26 


errors counter 43 
Esc key 44 


F7 
save remote analyzer 
configuration 16 
file 
.rootmenu 28, 29 
font.big 28, 29 
font.small 28, 29 
font.very.small 28, 29 
listing files 28 
print to 41 
README 27, 28, 29 
rsniff.config 21, 28, 29 
SniffMaster I files 28, 
29 


snifftool 28, 29, 30 
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font size 
menu item 40 


font.big file 28, 29 
font.small file 28, 29 
font.very.small file 28, 29 


frame 
command tool 27, 29 
console 27 
menu 27, 37, 38 
menu options 36 
SunView terminology 
16, 25, 35 


frame header 16, 36 


frame header menu, See 
frame menu 27 


frames counter 43 


full screen 
panel button 41 


function key 
button 44 
F7 16 
props 38 
hardware 
SniffMaster I 
requirements 8 


header 
frame 16, 36 
Help key 44 
hide props 
panel button 41 
histogram 
capture display 42 
Hughes LAN Systems 4208 
terminal server 
configuration 18 
icon 
console frame 26 
Sniffer 37 
SunView interface 26 


information 
panel button 41 


install remote analyzer 
menu item 16 


installation 

3Com Series 210-TCP 
21 

central console 21, 24 

Cisco System ASM 18 

Hughes LAN Systems 
4208 18 

Interlan NTS200 17 

remote analyzer 13 

terminal servers 17 


Interlan NTS200 
terminal server 
configuration 17 


Internet Protocol address, 
see IP address 17 


IP address 17, 18, 19, 20, 22, 
23, 24, 30 


Kbytes counter 42 
key 

+ 44 

Alt 44 

diamond 44 

Esc 44 

F7 16 

Help 44 

Meta 44 

props 38 

special keys and key 

sequences 44 

keyboard 

disabling 15, 40 
kilobytes counter 42 
list files command 28 
login prompt 25 
Is 


list files command 28 


main selection menu 
Sniffer analyzer 13, 35 


menu 

central console options 
menu 38 

editing .rootmenu file 
29 

frame 27, 36, 37, 38 

frame header 27, 37 

pull-down 36 

pull-right 39 

remote analyzer 
configuration 
menu 14 

root 27 

Sniffer analyzer main 
selection menu 13, 
35 

SniffMaster I remote 
analyzer selection 
menu 14, 16 


menu items 

adding to .rootmenu 
file 29 

baud rate 15, 16 

color console 15 

command tool 27, 29 

configure remote 
analyzer 14 

console 27 

display type 40 

display update mode 
40 


font size 40 

install remote analyzer 
16 

name 15 


password 15 

props 38 

remote keyboard is 40 

remote screen is 40 

remote Sniffer 
analyzer screen 
size 40 

remove remote 
analyzer 16 

shells 27, 29 

SniffMaster I remote 
analyzer 13, 38 


Meta key 44 


more 
command 29 


mouse 
button 27 
function key buttons 
44 


pointer 27 


multi-segment monitoring 
and analysis 7 


name 
menu item 15 


network 
security 40 


network security 8, 31 
disabling keyboard 15, 
40 


using password 15 


number 
port 17, 18, 23, 30, 31 


number of stations counter 


operating system 
UNIX 24 
options 
setting at central 
console 25, 38 
setting at frame menu 
37 
setting at remote 
analyzer 14 
setting with frame 
menu 36 


panel button 
central console options 
menu 40 
full screen 41 
hide props 41 
information 41 
quit 41 
refresh 41 
resume/suspend 41 
password 
automatic entry 30, 31 
menu item 15 
pointer 
mouse 27 
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port 
TTY port of terminal 
server 17 


port number 18, 23, 30, 31 
terminal server 17 
print 
to file 41 
prompt 
login 25 
props 
function key 38 
menu item 38 
props key 
opening central 
console options 
menu 38 


pull-down menu 36 
pull-right menu 39 
pwd 

check directory 

command 28 

quit 

panel button 41 
read file command 29 
README file 27, 28, 29 


refresh 
panel button 41 


remote analyzer 

adding items 
.rootmenu file 29 

configuration menu 14 

role in SniffMaster I 
system 6 

save configuration 16 

selection menu 14, 16 

setting options 14 


remote keyboard is 
menu item 40 


remote screen is 
menu item 40 


remote Sniffer analyzer 
screen size 
menu item 40 


remove remote analyzer 
menu item 16 


requirements 
Sniffer analyzer 8 
SniffMaster I hardware 
and software 8 
terminal server 8 
workstation 8 


resume /suspend 
panel button 41 
root 
directory 25 
root area 
SunView interface 26 


root menu 27 
editing 29 
root privileges 24 
RS-232 port 17, 21, 23, 24 
rsniff.config file 21, 28, 29 


save 
remote analyzer 
configuration 16 


security 
network 8, 15, 31 


set up 
3Com Series 210-TCP 
21 


central console 21, 24 

Cisco System ASM 18 

Hughes LAN Systems 
4208 18 

Interlan NTS200 17 

remote analyzer 13 

terminal servers 17 


shells 
menu item 27, 29 
submenu 27 
skylines 
capture display 42 
Sniffer analyzer 
icon 37 
main selection menu 
13, 35 
remote analyzer 
configuration 
menu 14 
starting from central 
console 35 


SNiffer Remote Protocol 6 
sniffmaster directory 28, 29 


SniffMaster I 
remote analyzer 
selection menu 16 


SniffMaster I remote 
analyzer 
menu item 13, 38 


SniffMaster I system 

asynchronous 
communications 6 

capabilities 7 

configuration 6 

remote analyzer 
selection menu 14, 
16 

role of central console 
6 

role of remote analyzer 


role of terminal server 


system information 41 
unique features 42 


snifftool file 28, 29, 30 


SNRP 
SNiffer Remote 
Protocol 6 


software 
central console 25 
SniffMaster I 
requirements 8 


Spacebar 
used in keyboard 
operation 44 


SPARCstation I 8 


summary view 
central console 43 


Sun 3/80 8 


Sun OS 
error messages 26 
tools 25 
Version 4.03 8 


Sun workstation 7, 25 
SunNet Manager 8 


SunView 6, 8 
bringing up 25 
console frame 26 
icon 26 
interface 26 
root area 26 
screen 26 


system information 
SniffMaster I 41 


tar tape 8, 25 
TCP port number 18, 23, 30, 
31 


terminal server 17 


terminal server 

3Com Series 210-TCP 
21 

Cisco System ASM 18, 
19 

Hughes LAN Systems 
4208 18 

Interlan NTS200 17 

role in SniffMaster I 
system 6 

TCP port number 17 

TTY port 17 


terminate-and-stay- 
resident program 
TSR6 
test 
procedure for 3Com 
Series 210-TCP 
connection 24 
procedure for Cisco 
System ASM 
connection 20 


tools 
Sun OS 25 
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TSR 
terminate-and-stay- 
resident program 
6 


TTY port 

terminal server 17 
UNIX operating system 24 
vi 


visual-interactive 
editor command 


visual-interactive editor 
command 30 


window 


SunView terminology 
25, 35 
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